Live › vulnerability › CVE-2026-111044
Go to dashboardSunshine, a self-hosted game stream host for Moonlight, accepted any client certificate chaining to a stored paired certificate instead of requiring the exact enabled identity. A previously paired client holding its private key can present a derived certificate to bypass the Disable control and keep streaming access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts running Sunshine from 2026.329.165800 through builds before 2026.906.222525 are exposed, and only against clients that were previously paired with the host. A client that was never paired cannot exploit this, so hosts where pairing is not used or where all paired clients are trusted can deprioritize it.
No product ranges from the sources yet.
2026.906.222525; versions from 2026.329.165800 up to but not including 2026.906.222525 are affected.2026.906.222525 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
This page as .md · .json · in your agent: get_signal("CVE-2026-111044")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.